Gonzalo Mon writes in Mashable that “Although various bills pending in Congress would require companies to get consent before collecting certain types of information, outside of COPPA, getting consent is not a uniformly applicable legal requirement yet. Nevertheless, there are some types of information (such as location-based data) for which getting consent may be a good idea.  Moreover, it may be advisable to get consent at the point of collection when sensitive personal data is in play.”

First, what current requirements – laws, agency regulations and quasi-laws – require obtaining consent, even if not “uniformly applicable”?

1. Government Enforcement.  The Federal Trade Commission’s November 2011 consent decree with Facebook user express consent to sharing of nonpublic user information that “materially exceeds” user’s privacy settings.  The FTC was acting under its authority under Section 5 of the FTC Act against an “unfair and deceptive trade practice”, an authority the FTC has liberally used in enforcement actions involving not just claimed breaches of privacy policies but also data security cases involving managing of personal data without providing adequate security.

2. User Expectations Established by Actual Practice.  The mobile space offers some of the most progressive (and aggressive) examples of privacy rights seemingly established by practice rather than stated policy.  For example, on the PrivacyChoice blog, the CEO of PlaceIQ explained that “Apple and Android have already established user expectations about [obtaining] consent.  Location-based services in the operating system provide very precise location information, but only through a user-consent framework built-in to the OS.  This creates a baseline user expectation about consent for precise location targeting.”  (emphasis added) Continue reading

For businesses, is there an obligation in the United States to do anything more than simply have a privacy policy?  The answer is not much of an obligation at all.

Put another way, is it simply a question of disclosure – so long as a business tells users what it intends to do with their personal information, can the business pretty much do anything it wants with personal information?  This would be the privacy law equivalent of the “as long as I signal, I am allowed to cut anyone off” theory of driving.

Much high-profile enforcement (via the Federal Trade Commission and State Attorneys General) has definitely focused on breaches by businesses of their own privacy statements.  Plus, state laws in California and elsewhere either require that companies have privacy policies or require what types of disclosures must be in those policies, but again focus on disclosure rather than mandating specific substantive actions that businesses must or must not take when using personal information.

As The Economist recently noted in its Schumpeter blog, “Europeans have long relied on governments to set policies to protect their privacy on the internet.  America has taken a different tack, shunning detailed prescriptions for how companies should handle people’s data online and letting industries regulate themselves.”   This structural (or lack of structural) approach to privacy regulation in the United States can also been seen – vividly – in legal and business commentary that met Google’s recent privacy overhaul.  Despite howls of displeasure and the concerted voices of dozens of State Attorneys General, none of the complaints relied on any particular violations of law.  Rather, arguments (by the AGs) are made about consumer expectations in advance of consumer advocacy, as in “[C]onsumers may be comfortable with Google knowing their search queries but not with it knowing their whereabouts, yet the new privacy policy appears to give them no choice in the matter, further invading their privacy.”

Again, there’s little reliance on codified law because, for better or worse, there is no relevant codified law to rely upon.  Google, Twitter and Facebook have been famously the subjects of enforcement actions by the states and the Federal Trade Commission, and accordingly Google has been careful in its privacy rollout to provide extensive advance disclosures of its intentions.

As The Economist also reported, industry trade groups have stepped in with self-regulatory “best practices” for online advertising, search and data collection, as well as “do not track” initiatives including browser tools, while the Obama Administration last month announced a privacy “bill of rights” that it hopes to move in the current or, more realistically, a future Congress.

This also should not ignore common law rights of privacy invasion, such as the type of criminal charges successfully brought in New Jersey against the Rutgers student spying on his roommate.   These rights are not new and for the time being remain the main source of consumer recourse for privacy violations in the absence of meaningful contract remedies (for breaches of privacy policies) and legislative remedies targeted to online transactions.

More to come on this topic shortly.

Unlike traditional newsroom journalists, “citizen journalists” have no formal way to ensure that everyone maintains similar quality standards.  Which does not mean that quality standards are necessarily (or consistently) maintained at traditional newsrooms, but rather that a traditional hierarchical editorial structure imposes at least theoretical guidelines.

By definition, citizen journalism’s inherent difference from the traditional editorial process is the dispersion of responsibility for editorial choice.  Nonetheless, “trustiness” in journalism is a concept still heavily dependent on a reporter’s or editor’s reputation.  Is the New York Times trusted because it’s trustworthy?  Or is it trustworthy because it’s trusted?

The “Generated By Users” journalism blog recently reported the results of its reader poll, “Do you TRUST user generated content in news?” Continue reading

Earlier this month, Dropbox spawned a new kerfuffle in internet-land with changes to its Terms of Service (TOS).

The outrage was fast and furious.  A nice deal of blog and Tumblr and other commentary zeroed in on changes Dropbox announced to its TOS before the 4^th of July holiday, and in particular how this or that provision “won’t hold up in court”.  See for example J. Daniel Sawyer’s commentary here.

Sawyer was referring to language in the TOS for cloud-server services granting ownership rights to Dropbox or other cloud services.

At least I think that’s what he was referring to, because the Dropbox TOS did not actually grant those ownership rights to Dropbox.  Dropbox’ TOS – like similar TOS for SugarSync and Box.net – granted limited use rights to enable Dropbox to actually provide the service.  Here is the offending provision:

… you grant us (and those we work with to provide the Services) worldwide, non-exclusive, royalty-free, sublicenseable rights to use, copy, distribute, prepare derivative works (such as translations or format conversions) of, perform, or publicly display that stuff to the extent we think it necessary for the Service.

To be clear, if Dropbox actually claimed ownership rights to customer files – and actually provided for the same in its TOS – there’s no particular reason such a grant “won’t hold up in court”.   There are certainly cases of unenforceable contracts – contracts that are fraudulently induced or in contravention of public policy, for example – but a fully and clearly disclosed obligation in exchange for a mutual commitment of service is enforceable. Continue reading

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Today, I discuss BitTorrents, and a particular case in California challenging the copyright validity of what one service provider is doing.  BitTorrent has been in the (copyright) news lately – and not surprisingly – after the movie studios set their sites on bringing down yet the latest iteration of file-sharing technology.

Some of the issues I discuss are these:

• What is the BitTorrent file sharing technology? And how is it different from Napster and its peer-to-peer progeny?

• What are the 2 biggest distinctions between BitTorrent and peer-to-peer and, in particular, BitTorrent’s distributive approach to file-sharing?

• Why is bitTorrent in the (copyright) news? I will particularly discuss a case in federal court in California, involving Columbia Pictures and other film studios who sued a bitTorrent company called isoHunt, together with its founder, Gary Fung.

• What were the relevant legal issues in this case? Several important copyright arguments were made, but of most significance were 2 particular issues: inducement of copyright infringement, and the safe harbor for providers of “information location tools” under Section 512 of the Digital Millennium Copyright Act (the DMCA).

• Why did Google get involved? I discuss how this case was an unusual instance where a court ruled that DMCA safe harbor protection was not available to a provider of “information location tools” who knew or should have known about potential or actual copyright infringement happening on its service.

Please click below for the podcast.

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

BitTorrent has been in the (copyright) news lately – and not surprisingly – after the movie studios set their sites on bringing down yet the latest iteration of file-sharing technology.

2 great background sources on what BitTorrent is and how it works can be found here and here.  In short terms, BitTorrent is a file sharing technology, different from Napster and its peer-to-peer progeny in that it draws down pieces of large data files from multiple computers – rather than single computer to single computer peer-to-peer – based on a “community” structure of participating individual users.  The two biggest distinctions are (1) no single source for the compiled total file contributes more than a very small portion of the total file and (2) the distributive structure finesses the constant file-sharing problem of large data transfers demanding large broadband resources.

Why is bitTorrent in the (copyright) news?

BitTorrent is in the news not simply because Netflix’ CEO stated that “we’ve finally beaten bitTorrent.”  (“We”, by the way, presumably refers to Netflix’ full-file streaming capabilities.)

Continue reading