Israeli Supervisor of Banks Issues Letter on Social Networking

Reporting from Israel, legal consultant Dr. Omer Tene writes:

On July 28, 2010, the Israeli Supervisor of Banks, Rony Hizkiyahu, issued a letter to the CEOs of all local banks expressing concern over the banks' and their employees' use of online social networks, including both proprietary Web 2.0 tools and networking sites such as Facebook, Twitter, LinkedIn, MySpace and YouTube, all of which are explicitly referred to in the letter.  The Supervisor of Banks, Israel’s banking regulator, requires banks to take steps to ensure data protection and information security, including having outside experts perform risk assessments, creating and enforcing policies for use of social networking tools as well as guidelines and procedures for implementation and audit, and devising a data security strategy to address increased risks to employee and customer data.  These instructions are in addition to the Supervisor of Banks Proper Conduct of Banking Business Regulation No. 357, Information Technology Management, as well as applicable data protection law and regulations.

View the Supervisor of Banks’ letter (in Hebrew).

Facebook Announces Privacy Changes for Third-Party Applications

Bret Taylor, the Chief Technology Officer of Facebook, announced this week on the Facebook Blog that the company will enhance privacy protections pertaining to third-party applications.  When a Facebook user logs into a third-party application with his or her Facebook account, the application will only be able to access the public parts of the user’s Facebook profile.  If the application wants to access private sections of a user’s Facebook profile, the application has to explicitly ask the Facebook user for permission.  For example, if a greeting card application wants to access a user’s photos to create a personalized greeting card, the Facebook user will have to click a button to allow such access.

In his announcement, Mr. Taylor stated that the changes “reflect two core Facebook beliefs: first, your data belongs to you; second, it should be easy to control what you share.  If at any point you ask a developer to remove the data you’ve granted them access to, we require that they delete this information.”  The changes come in the wake of scrutiny by both legislators and privacy organizations regarding privacy protections on the social networking website.

Twitter Settles FTC Data Security Charges

Twitter has agreed to settle Federal Trade Commission charges that it deceived consumers and put their privacy at risk by failing to safeguard their personal information.  The charges stem from alleged lapses in the company’s data security that permitted hackers to access tweets that users had designated as private and to issue phony tweets from the accounts of some users, including then-President-elect Barack Obama.  According to the FTC’s complaint (main document, exhibits), these attacks on Twitter’s system were possible due to a failure to implement reasonable safeguards, including:

  • requiring employees to use hard-to-guess administrative passwords that are not used for other programs, websites or networks;
  • prohibiting employees from storing administrative passwords in plain text within their personal email accounts;
  • suspending or disabling administrative passwords after a reasonable number of unsuccessful login attempts;
  • providing an administrative login webpage that is made known only to authorized persons and is separate from the login page for users;
  • enforcing periodic changes of administrative passwords by, for example, setting them to expire every 90 days;
  • restricting access to administrative controls to employees whose jobs required it; and
  • imposing other reasonable restrictions on administrative access, such as by restricting access to specified IP addresses.

The proposed settlement agreement contains a consent order requiring Twitter to implement data security safeguards and submit to periodic independent security audits.  The FTC’s press release contains more details.

Privacy Settings on Social Networking Sites May Determine Protection Under Stored Communications Act

On May 26, 2010, the court in Crispin v. Christian Audigier, Inc. quashed portions of subpoenas seeking the disclosure of private messages sent through Facebook and MySpace.  The court left open the question of whether Crispin’s wall postings and comments should be disclosed pending a more thorough review of his online privacy settings. 

On February 10, 2010, defendants in the copyright infringement case subpoenaed the social networking sites for wall postings and private messages from plaintiff Crispin’s accounts.  Crispin filed a motion to quash the subpoenas, asserting that the Stored Communications Act (“SCA”) prohibited the disclosure.  The SCA generally prohibits an entity that provides an “electronic communication service” (“ECS”) or a “remote computing service” (“RCS”) to the public from disclosing the contents of certain communications that are carried, maintained or stored on that service. 

After a lengthy analysis, the court determined that Facebook and MySpace were each either an ECS or RCS and thus potentially covered by the SCA.  The court then referred to a provision in the federal Wiretap Act stating that “[i]t shall not be unlawful under [the SCA] for any person . . . to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public.” (emphasis added)  Based on this provision, the court quashed the subpoena insofar as it sought messages that Crispin sent through the websites’ private messaging services.  The court found that those communications are “inherently private” such that the stored messages are not “readily accessible to the general public.”

The plaintiff’s Facebook wall posts and MySpace comments, however, presented a thornier question.  Because Crispin’s privacy settings could have determined whether his wall posts were public, the court declined to resolve the issue, instead directing that the parties “develop a fuller evidentiary record regarding plaintiff’s privacy settings and the extent of access allowed to his Facebook wall and MySpace comments.”

U.S. Legislators Urge Enhanced Privacy Protections for Social Networking Websites

Legislators at the federal and state levels are urging social networking websites to enhance privacy protections available to their users.  On April 27, 2010, four U.S. Senators wrote a letter to Facebook’s CEO expressing “concern regarding recent changes to the Facebook privacy policy and the use of personal data on third party websites.”  The letter urged Facebook to provide opt-in mechanisms for users, as opposed to lengthy opt-out processes, and highlighted default sharing of personal information, third-party advertisers’ data storage and instant personalization features as three areas of concern.

The Senators’ letter to Facebook comes on the heels of New York Senator Charles Schumer’s April 26, 2010, letter to the Federal Trade Commission asking it to look into privacy concerns about the use and disclosure of personal data on social networking websites.  Senator Schumer offered to “introduce appropriate legislation” that would give the FTC authority in “creating effective guidelines and protecting the privacy of online social network site users.” 

At the state level, the California Senate passed a bill on April 22, 2010, that prohibits social networking websites from displaying, “the home address or telephone number of a registered user who identifies himself or herself as being under 18 years of age” to the public or to other registered users.  Social networking websites that “knowingly and willfully” violate the provision can be fined up to $10,000 for each violation.  The measure is currently being considered by the California State Assembly.

Comments by Outgoing FTC Commissioner Pamela Jones Harbour Suggest Continuing Focus on Consumer Privacy by the Commission

The Wall Street Journal is reporting that outgoing FTC Commissioner Pamela Jones Harbour criticized technology companies for publicly exposing consumer data, particularly during the rollout of new products.  Ms. Harbour lamented that companies do not take consumer privacy seriously.  She singled out the launch of Google Buzz as irresponsible conduct by “one of the greatest technology leaders of our time.”  Consumer advocates raised alarm when Google Buzz initially established Google Gmail users’ social network connections automatically based on the users’ email and chat contacts, and made that list public by default.  Ms. Harbour reiterated the advocates’ sentiment by stating that, from the time the product launched, consumers rather than Google should have decided whether or not to subscribe to the features that could expose their contact data.  Soon after the launch, Google changed the defaults to allow users more control.  Google put forth a conciliatory message, stating that user transparency and control are top priorities for the company and that Google is continuing to improve Buzz based on the feedback the company receives.

Ms. Harbour concluded that privacy is a fundamental right that consumers expect businesses to respect regardless of advances in technology.  She expects the FTC to continue to evaluate consumers’ preferences and, armed with these insights, “shape the conversation about the intrinsic value of privacy.”  Ms. Harbour also expects the FTC to step in to protect consumers where the Commission believes companies have violated privacy promises.

While Ms. Harbour noted that she was expressing her own views rather than the FTC’s, recent commissioner appointments suggest that the FTC will continue to be increasingly active in privacy enforcement.  Specifically, one of the newly appointed commissioners, Julie Brill, has spearheaded litigation and legislative efforts in a wide variety of areas affecting consumers, including privacy, in her roles as Assistant Attorney General for Consumer Protection and Antitrust for the State of Vermont and Deputy Attorney General for Consumer Protection and Antitrust for the State of North Carolina.  Ms. Brill also has served as Chair of the Committee on Privacy for the National Association of Attorneys General.

Senior Google Executives Sentenced for Violation of Italian Privacy Laws

In February 24, 2010, an Italian court in Milan found three Google executives guilty of violating applicable Italian privacy laws.  The executives were accused of violating Italian law by having allowed a video showing an autistic teenager being bullied to be posted online.  The Google executives, Senior Vice President and Chief Legal Officer David Drummond, Chief Privacy Counsel Peter Fleischer and former Chief Financial Officer George Reyes, were fined and received six-month suspended jail sentences.

The case, which is the first of its kind, was brought by a public prosecutor in Milan and did not involve Italy’s data protection authority, the Garante.  It calls into question the interpretation of European privacy laws as it appears to suggest that employees of organizations that provide services such as Google Video and YouTube, may be found criminally responsible for content that users upload, even though they have no control over such content.  The case also suggests that hosting and social networking providers may no longer rely on the EU safe harbor that absolves them of liability for the content posted on their websites, provided they remove unlawful content as soon as they are notified of its presence.

Concerns also have been expressed with respect to the impact of the ruling on the principles of freedom on which the Internet was founded, including freedom of speech and freedom of information.  Arguably, if hosting and social networking providers are required to screen or vet all content uploaded to their websites, such freedoms are jeopardized, as is the very existence of such organizations.  In the words of Richard Thomas, the UK’s former Information Commissioner and Senior Global Privacy Advisor to Hunton & Williams, the case is “ridiculous” and “it is unrealistic to expect firms to monitor everything that goes online.”

Update: The Italian Judge's full opinion was released April 12, 2010.

Canadian Privacy Commissioner Investigates Facebook

Pursuant to a public complaint, on January 27, 2010, the Privacy Commissioner of Canada announced a new investigation into Facebook.  The investigation concerns the social networking site’s introduction of a tool that required its users to review their privacy settings in December 2009.  According to the complaint, Facebook’s new default settings allegedly made some users’ information more accessible than previously had been the case.  Elizabeth Denham, the Assistant Privacy Commissioner, indicated “[s]ome Facebook users are disappointed by certain changes being made to the site – changes that were supposed to strengthen their privacy and the protection of their personal information.”

The new complaint follows the Commissioner’s July 2009 release of findings resulting from an investigation into Facebook’s privacy policies and practices.  The findings highlighted concerns regarding Facebook, including a need for increased transparency and clarity.  The Office of the Privacy Commissioner will continue to follow up with Facebook as the company implements changes to its site.  

For further information, please see the Office of the Privacy Commissioner's News Release.

FINRA Issues Guidance on the Use of Blogs and Social Networking

On January 25, 2010, the Financial Industry Regulatory Authority (“FINRA”) issued Regulatory Notice 10-06, Guidance on Blogs and Social Networking Web Sites (the “Guidance”) for securities firms, investment advisors and brokers.  FINRA, which is the largest non-governmental financial regulator, previously had issued guidance on other issues pertaining to interactive web sites, such as participation by securities firms and their employees in Internet chat rooms discussing stocks or investments.  The goals of the Guidance are to “ensure that—as the use of social media sites increases over time—investors are protected from false or misleading claims and representations” as well as “to interpret [the] rules in a flexible manner to allow firms to communicate with clients and investors using” blogs and social networking.

The Guidance sets forth important responsibilities for securities firms, including that they should (i) retain records of communications made through social media sites; (ii) consider adopting policies and procedures governing communications that promote specific investment products; (iii) supervise electronic communications in a manner “reasonably designed” to ensure that they do not violate FINRA rules; (iv) prohibit employees from engaging in business communications on social media web sites that are not subject to the firm’s supervision; and (v) screen third-party content on firm-sponsored blogs or social networking web sites.

Although the Guidance is informal and intended to assist securities firms in establishing their own social media policies and procedures, FINRA may eventually codify the Guidance in a formal rule and thereby enable it to enforce compliance and impose fines for any violations of such a rule.

The full text of the Regulatory Notice is available on FINRA’s website

Privacy Commissioner of Canada Announces Public Consultations on Emerging Technologies

On January 18, 2010, the Privacy Commissioner of Canada, Jennifer Stoddart, announced a public consultation to examine the privacy issues associated with online tracking, profiling and targeting of consumers.  The Commissioner noted that the consultation will “provide a forum for the exploration of the privacy implications related to this modern industry practice, and the protections that Canadians expect.”  The consultation marks the first in a series to review emerging technologies that are likely to have a considerable impact on consumer privacy.  The announcement of a second consultation on cloud computing is anticipated in the near future.

The Office of the Privacy Commissioner has put out a call for participation and written submissions by interested parties are due by March 15, 2010.  For further information on the consultation process, view the Office of the Privacy Commissioner's news release.

Federation of German Consumer Organisations Successful against Social Networks - Providers Intend to Discontinue Use of Certain Data Protection Provisions

On November 12, 2009, the Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband e.V., “vzbv”), a non-governmental organization acting as an umbrella for 41 German consumer associations announced that the social networks Xing, MySpace, Facebook, Lokalisten, Wer-kennt-Wen and StudiVZ signed undertakings that they would discontinue use of certain terms and conditions and data protection provisions.  The vzbv sent warning notices to the six leading social network providers regarding a number of clauses.

The main criticism from vzbv referred to general terms and conditions and data protection provisions that disadvantaged users and gave wide-ranging rights to the providers.  The provisions regarding comprehensive use of data and data processing have been a primary subject of the proceedings.  These uses and processing often took place without the user’s consent and exceeded the original purpose for which the data were collected.  These practices are supposed to be changed in the future.  The providers promised to implement amendments to the provisions by January 2010 the latest.

The vzbv also has published a position paper that outlines what providers need to be doing from a user perspective.  This guidance includes for example, that the providers should ensure restrictive pre-settings for user profiles to more fully protect new users.  In addition, the providers should assess implications for data protection and consumer protection in case of new technical developments.

For more information please see the press release by vzbv (in German).

New FTC Blog Guidelines Affect Companies Without Blogs

On October 5, 2009, the Federal Trade Commission (“FTC”) issued amendments to its Guides for the Use of Endorsements and Testimonials in Advertising (“Guides”).  Reactions to the amendment have primarily focused on the provisions that require bloggers to disclose their relationship with companies whose products they endorse.  Largely absent from the commentary, however, have been observations regarding theories articulated in the amendments that demonstrate the risk of enforcement for companies that do not have a blog and that do not use third-party bloggers for promotion.

The Guides address the application of Section 5 of the FTC Act to the use of endorsements and testimonials in advertising.  Although the Guides provide a basis for voluntary compliance with the law by advertisers and endorsers, practices inconsistent with them may result in enforcement action by the FTC.  The Guides set forth general principles that the FTC intends to use in evaluating endorsements and testimonials, together with examples illustrating the application of those principles.

First issued in 1975 and 1980, these Guides generally require that endorsements reflect the honest opinion of the endorser and not contain representations that would be deceptive if made by the advertiser.  In November 2008, the Commission proposed amendments to the Guides, including changes to clarify the obligations of bloggers and other users of new communication technologies and advertising strategies.  In the final Guides, as under the pre-amendment Guides, when an expert or celebrity receives payment to endorse a company’s product in advertisements, the company does not need to explicitly disclose the fact of the payment in advertisements, since the public generally understands that experts and celebrities endorse products because they are paid to do so.  Conversely, when a non-expert or non-celebrity endorses a product (e.g., a “man-on-the-street” testimonial), any payment must be disclosed, since the public generally does not expect such endorsement to have been influenced by payment.  The amended Guides provide a new example of this principle in the online context:  an employee of a manufacturer of MP3 players visits an online MP3 discussion board and posts comments promoting her employer’s products without disclosing the employment relationship.  As a result, whether or not a company has its own blog or engages third-party bloggers, there may be some risk of enforcement based on employee activities.  The amendment explains that the employee should disclose the relationship, since knowledge of the poster’s employment likely would affect the weight or credibility of her endorsement.  The scope of the amendments suggest that the FTC’s view on this matter would extend to promotional comments made by persons with such undisclosed material connections to the promoted company in any emerging communications tool, such as online discussion boards, blogs, social networking sites, Twitter, etc.

To mitigate risk given the FTC’s new focus on this sort of activity, businesses may wish to (i) require their employees to disclose the employment relationship when making online comments that promote the employer or its products, (ii) require that such comments be vetted by the business, or (iii) prohibit employees from making online comments.  Businesses should also consider training employees on any such policies that the business may establish.

FTC Announces Public Roundtables on Consumer Privacy Issues

On September 15, 2009, the Federal Trade Commission unveiled a series of public roundtables that will focus on the effect of modern technology and business practices on the privacy of consumer information.  The goal of the panels is to explore how to best balance the concerns for consumer privacy, beneficial use of consumer information and technological innovation.  The discussions will address myriad technologies and practices, such as social networking, cloud computing, behavioral marketing, mobile marketing and, generally, the collection of consumer information for various purposes.  The roundtables will also consider the adequacy of existing legal and self-regulatory frameworks.  Participants will include academics, privacy experts, consumer advocates, industry representatives, technology experts, legislators, and experts from outside the United States.  The Commission has asked individuals and organizations to submit requests to participate as panelists and suggest discussion topics.  The Commission also has asked interested parties to submit written comments and research on the issues of (i) risks, concerns and benefits associated with the collection and use of consumer information, (ii) consumer expectations of how their information is used, and (iii) the adequacy of existing legal requirements and self-regulatory regimes in protecting consumer privacy interests.

Click here for more information on the Commission’s news release.

German Social Networks Signed Code of Conduct

On March 11, 2009, the operators of Germany's leading social networks, which include "schuelerVZ," "studiVZ,"  "lokalisten" and "wer-kennt-wen," signed a 17-page Code of Conduct by the Association for Voluntary Self-Regulation of Multimedia Service Providers (the “Code”) in order to protect children and young people. The Code of Conduct aims to improve data protection and consumer protection in social networks and, in particular, to protect young people against harassment. The Code requires that a privacy notice be displayed directly after the registration process and that restrictive default settings be enabled for users under the age of 14. In addition, it must be possible to lock user profiles from search engines, and to block communication with other users. At prominent locations of the sites, features should be implemented to allow users to report irregular behavior and illegal content. The Code also states that sites may only use personal data for marketing and behavioral advertising if the user has been informed of this use of their data and has consented. Furthermore, any advertising material has to be clearly marked as such in accordance with the principle of separation of advertisement and content. The Code also contains a rule on blacklists and provisions regarding disclosure of data in response to law enforcement requests. The companies operating the aforementioned sites, studiVZ Ltd., Lokalisten Media GmbH and lemon line media Ltd. (wer-kennt-wen.de), have agreed to comply with the Code by the end of July 2009. The Code calls upon other social networks to sign it as well. The full text of the Code (in German) can be found here