Two dueling tattoo parlors down the road from one another in Mobile, Alabama. It could be the premise of a TLC reality show.  It’s not (yet) a TV show, but it IS a court case recently decided by the Alabama Court of Civil Appeals. In September, that court ruled in favor of Chassity Ebbole, owner of “LA Body Art” tattoo parlor in Mobile, who had sued the owners of the competing “Demented Needle” tattoo shop for libel and wrongful invasion of privacy.

Ebbole claimed that Demented Needle owner Paul Averette had been telling customers and others that Ebbole’s shop used equipment infected with diseases such as Hepatitis C and HIV, claiming also that Averette had told the world that Ebbole had infected herself.

Continue reading

In June of this year, Senator Al Franken (D. Minn.) introduced the “Location Privacy Protection Act of 2011” (S. 1223).  According to the bill summary available on Franken’s website, a 2010 investigation by the Wall Street Journal revealed that 47 of the top 101 mobile applications for Apple iPhones and Google Android phones disclose user location without consent of the user.

According to Franken’s bill summary, current law prevents disclosure of user location during telephone calls without user consent. Currently, no similar legislation protects user location when a user accesses information through a mobile web browser or mobile application. Franken claims that his bill will close loopholes in the Electronic Communications Privacy Act that allow for this distinction.

If S. 1223 passes, companies will be required to obtain permission not only to collect mobile user location information but also to share that information with third parties. Additionally, the bill seeks to put in place measures to prevent stalking through location information.

As of this writing, Franken’s bill has been assigned to the Senate Judiciary Committee and is being cosponsored by Sens. Blumenthal, Coons, Durbin, Menendez, and Sanders.

Original Post (published 9/8/2011)

When was the last time you read a license agreement after installing software or downloading an app on your smartphone? If you’re like most people, the answer is probably never.

According to some estimates, fewer than 8 percent of us actually read the entirety of those agreements, despite rising concerns about digital privacy and data collection. Continue reading

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Today, we will discuss the business and, particularly, the legal landscape faced by application (App) developers dealing with mobile platforms (iOS, Android and Blackberry being dominant), including dealing with application interfaces (APIs) when developing based on existing applications, and, of course, client relationships.

I am joined today by Liz Steininger, co-founder of Tapangi Consulting and project manager in the DC Government’s Office of the Chief Technology Officer.  Tapangi Consulting specializes in mobile and HTML5 application development as well as content management.  Liz is also an active member of the DC Tech community and you can find her on Twitter as @liz315.

Some of the issues we discuss today are these:

• Protecting ideas in early stages of pitching to potential clients.

• Application developer agreements and API Terms of Use (TOUs).

• Platform question: As a developer, how do you think about development based on different platform (e.g. Android or iOS or Blackberry) or a specific API?

• Copyright and “open source” issues, GPL, libraries, use of third-party code.

• Ownership and Rights Issues

• Privacy and uses of personal information (PI).

Please click here for the podcast.

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Our Twitter chat last week with technology and entertainment lawyer Joy Butler highlighted legal issues with app development, including contract issues between app developers and clients, on one end, and intellectual property (IP) and API issues between the app and the intended development platform, on the other end.

Privacy issues become pressing later when the app goes public for end users, although the biggest privacy problems tend to arise when app publishers get tripped up by commitments made in their own end user license agreements (EULAs) or privacy policies, more so than from any violations of privacy laws.  More on privacy and the app/API problems in a separate blog post.

Immediate issues are copyright and trademark, both governed by federal laws, but also governed by API terms of use and similar application development agreements with hosting platforms.  Apple’s software developer kits (SDK) for the iPad and iPhone encompass similar purposes as part of broader packages of developer protocols for use of those APIs.

Continue reading

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

In January, the Supreme Court agreed to hear arguments in the case of IMS Health v. Sorrell, an appeal of a ruling in November in favor of data aggregator IMS Health by the U.S. Court of Appeals for the 2nd Circuit. The case involves a 2007 Vermont statute, similar to laws in many other states, that prohibits the use, sale and transfer of prescriber-identifiable data (referred to as “PI Data”) for marketing purposes, unless a prescriber (meaning: a physician) opts in to allow use of his or her PI Data. The State of Vermont and its supporters argue that any 1st Amendment challenges to the law by users of the PI Data are sufficiently overcome by substantial privacy interests of doctors and their patients.

To discuss these issues, my guest today is John Verdi, Senior Counsel of the Electronic Privacy Information Center (EPIC).  John and EPIC have filed an amicus brief in the Supreme Court in support of Vermont’s position, and I’ve asked John to join me today to briefly discuss the privacy issues involved.

Please click the link below for the podcast.

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Thanks to Andrew Mirsky for contributing research and feedback to this post.

Does a corporation have the same rights as a person?

It really depends on the context. In the context of personal privacy, the answer is no.

In a unanimous ruling this month, the Supreme Court found that corporations are not entitled to the same “personal privacy” rights as individuals under the Freedom of Information Act (FOIA).

After a 2004 investigation by the Federal Communications Commission (FCC) into AT&T’s billing practices, a trade group including AT&T competitors submitted a FOIA request to the FCC seeking records of the inquiry. The FCC protected some of AT&T’s trade secrets and customers’ personal information, but refused AT&T’s request under the personal-privacy exemption in FOIA to protect certain other information.  The FCC ruled that AT&T’s records should be publicly released under FOIA because the company could not claim “personal privacy.”

Continue reading

A privacy policy?  Who needs a privacy policy?  Privacy is a mess.  You’re building an online business, and you figure you have to have a privacy policy.  But why?  Is “because everyone else has one” a good enough reason?  Ever wonder what you really need to know about privacy law?  I mean … what you have to comply with as a business operating in an online environment?

Here, then, the first of several Frequently Asked Questions about privacy policies.  Or to be more precise, here now some practical answers on privacy practices:

FAQ #1: Can I simply post a privacy policy and forget about it?  Short Answer: No.  Longer Answer: No, because as between posted statements and actual compliance, actual compliance is what’s required.   Continue reading

Podcast #1: December 30, 2010

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

In today’s podcast, we discuss the Federal Trade Commission’s recently issued privacy proposals. My guest is Karen Neuman, a founding partner of St. Ledger-Roty Neuman & Olson LLP, a Washington, DC law firm that focuses on regulation of information technologies and communications law, including privacy & data security, mobile communications, the Internet, media, telecommunications and related transactional matters.

At the core of the new privacy proposal is the idea that the current system of self-regulation does not provide enough consumer protection.  Basically, from the FTC’s perspective, people do not pay enough attention to the data-collecting activities of websites and not enough companies are up-front about the data they do collect from visitors to their sites.  The FTC says that while many companies detail their data collection through privacy policies, consumers bear too much of a burden in having to sort through such long, legalistic documents.

Among other proposals, the FTC’s new framework would require a “Do Not Track” option, much like the one we currently have to avoid telemarketers.  “Do Not Track” would essentially prevent companies from tracking things like your browsing history and buying habits, making it much more difficult for them to target consumers with personalized ads.  The proposal also aims to have companies incorporate more consumer protection into their business practices through simpler, more transparent options and by allowing consumers more access to the data being collected about them.  The FTC issued its proposed rules just last week, and requested public comment from both businesses and the public.

Please click play on the audio player below to hear the podcast.

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

What is the legal significance of a website’s privacy policy?

That question lingers when reviewing such policies for legal compliance and for consistency with a company’s actual practices.  Problem is, lawsuits involving claims of breaches of privacy policies have failed even in cases of clear and egregious violations by the service provider, where there was an absence of a showing of actual damages.

Eric Goldman cites a number of cases in his blog, including a prominent class action in 2005 against Jet Blue Airlines for voluntarily turning over passenger names to a government contractor, in clear violation of the airline’s stated privacy policy.  Policies commonly permit the service provider to disclose information in response to a government demand.  Yet, Jet Blue won dismissal despite any such disclosure right in its policy. Continue reading

Last week, Facebook joined the social media craze of “checking in,” with its new service called Places. The move indicates an increasingly popular trend, pioneered by services like Four Square. Whether at a famous historical landmark or their local Starbucks, people use location check-ins to let friends know where they are and earn badges for covering more ground.

Some think the next phase in the check in revolution is coming soon to a couch near you. Entertainment could be the next big thing that draws users to check in and share what they’re doing with others. Services like GetGlue, Miso, and Philo encourage you to share what you’re watching and engage with people doing the same. Besides the social networking incentive to interact with fellow fans of your favorite shows, these applications offer tokens and badges for every time you keep up with the Kardashians or tune in to see what Snooki will do next on Jersey Shore. Continue reading