Privacy and Advertising Alert

PRIVACY

European Union High Court Ruling Establishes Right to Be Forgotten, Requires Google to Delete User Data on Request

Google Inc. must delete the personal data that turns up in its search results under certain circumstances if a user asks for the data to be deleted, the European Court of Justice (ECJ) ruled on Tuesday, May 13.  The decision by the ECJ – the highest court in Europe – is the first to address a subject that has been hotly debated in connection with the proposed European Union (EU) Privacy Regulation: the “right to be forgotten.” For businesses, the ruling will greatly complicate maintaining an online presence that involves publishing data about an EU citizen online, and raises new jurisdictional questions on the reach of European data protection laws.

The case arose after a Spanish lawyer’s search for his name using Google’s search engine turned up legal notices related to his debts and the forced sale of his property that were published in an online Spanish newspaper. The Spanish Data Protection Agency ruled against Google but did not require the newspaper to remove the data. Google appealed to the ECJ. The ECJ’s decision is contrary to a June 2013 opinion of the Advocate General that Google need not remove the links.

This ruling is based on the EU’s 1995 Data Protection Directive (Directive 95/46/EC), which provides “data subjects” certain legal rights, including the right to access collected information and correct inaccuracies. The ECJ found that if a search engine’s inclusion of links to personal data in its search results contravenes the purposes of the Directive, the links and information in the results lists must be erased, even if initially including the links and associated information in search results was acceptable. In other words, given sufficient passage of time, initially-lawful processing of data may become incompatible with the Directive where the purposes behind providing the data diminish relative to the data subject’s interest in having the data erased or blocked. The ruling would permit links to such data to remain online, however, where there are particular public interest reasons justifying the public’s continued access to the information, such as the data subject’s role in public life.

In the meantime, the proposed EU Regulation on Privacy, which the European Commission proposed in 2012, is expected to move forward, but passage seems unlikely before 2015, and it would not take effect for another two years. Other countries have adopted the EU’s approaches to privacy in various forms, which could result in similar requirements applying more broadly. Companies that maintain an online presence, and in particular provide information about the general public, must keep abreast of the EU and other countries’ decisions about the existence of a right to be forgotten, and consider the balance between rights to information and privacy rights in a global environment.

Snapchat Settles FTC Charges of Deception

The photo and messaging app Snapchat has agreed to settle with  the Federal Trade Commission (FTC) allegations that it misrepresented the quantity of consumer data it collected and stored and falsely claimed that its messages would disappear. In marketing its privacy features, Snapchat stated that users could send photos or video messages (“snaps”) that would only be viewable for a brief period before “disappearing forever.” The FTC alleged that the app’s claimed function was in “stark contrast” to reality, saying messages could be easily saved by conducting simple workarounds, taking screenshots, and using third-party apps to save the data.

The FTC also alleged that Snapchat failed to adequately protect its “Find Friends” feature, failed to disclose that it gathered sensitive information from consumer address books, and did not directly inform consumers when it began disseminating geolocation information. The lax security surrounding the “Find Friend” feature allowed security researchers to compile a database of 4.6 million users’ names and phone numbers. Snapchat’s privacy policy, published between 2011 and 2013, also allegedly failed to inform consumers that the company began collecting users’ location in 2012.

The terms of the settlement prohibit Snapchat from making false or misleading privacy claims, require Snapchat to establish a privacy program, and require independent monitoring for 20 years.

White House Releases Big Data Reports

The Administration released two reports on big data on May 1, 2014, following a 90-day study commissioned by President Obama to conduct comprehensive reviews of policy issues related to big data and privacy. The main report, Big Data: Seizing Opportunities, Preserving Values, acknowledges that current capabilities for data collection, storage, processing, and use are massive and growing. The report highlights some of the benefits of data collection, including better health outcomes, more efficient transportation, and better fraud identification, but also some dangers to privacy and the potential to circumvent civil rights protections in housing, employment, and credit. Ultimately, the report’s authors (including John Podesta, a special advisor to the President) mostly reiterate extant Administration proposals (for example, seeking passage of the Consumer Privacy Bill of Rights and national data breach legislation) and also recommend that certain privacy protections be extended to non-U.S. citizens. The main report, Big Data: Seizing Opportunities, Preserving Values was prepared by the President’s Council of Advisors on Science and Technology to assess current and future capabilities associated with big data. It recommends shifting more attention to actual uses of big data and less to collection or analysis and avoiding embedding specific technological solutions into policies, among other things.

ADVERTISING

FTC Issues Final Order Settling Misleading Biodegradability Claims

In another demonstration of its renewed focus on “green claims” following the FTC’s 2013 Green Guides revision, the FTC announced that it settled with American Plastic Manufacturing, Inc. allegations that the company made false biodegradability claims for its products. The settlement is the fourth in a set of green marketing cases that the FTC announced in October 2013. Although this settlement does not require the company to pay a fine, a previous settlement included a $450,000 fine. The FTC traditionally has viewed plastic biodegradability claims with some disfavor, and California expressly prohibits most such claims (see California Public Resources Code § 42357).

The settlement prohibits American Plastics from making misleading or unsubstantiated biodegradability claims. To make a qualified claim, the company must have scientific evidence that its product decomposes into an element found in nature within one year of customary disposal (i.e., landfill, recycling facility, or incinerator) within the environment where the product is purchased. If the product does not decompose completely within a year, the company may disclose the extent to which the product degrades and state that the product may not ever decompose completely.

FTC Settlement Prohibits Advertisers from Misrepresenting Product’s Capabilities

The FTC announced settlements with Nissan North America, Inc., and its advertising agency, TBWA Worldwide, Inc., over allegations of deceptive advertising. The FTC filed a complaint against the two organizations relating to a 30-second advertisement for a Nissan that shows a truck pushing a dune buggy up a steep sand dune, something the FTC claimed the truck cannot do. The ad did not disclose the fact that both the truck and the dune buggy were positioned on the hill with cables, and the FTC also claimed that the hill was made to look steeper than it actually was.  The FTC confirmed that, while special effects can be used in advertising, an ad cannot misrepresent the product’s capabilities.  Nissan and TBWA agreed to not misrepresent any material quality or feature of a pickup truck in future advertisements.  Companies that advertise their products in a mimicking amateur style should be extra-vigilant to ensure that the ad’s content is clearly disclosed and understood by an average audience member.

FTC Settles with Two Companies Who Claimed Their Products Could Cure Disease

The FTC settled with two marketers of personalized genomic products, alleging they falsely claimed that their genetically modified supplements could treat disease. GeneLink, Inc., and its former subsidiary, foru International Corporation, made claims that their nutritional supplements treated diabetes, heart disease, arthritis, insomnia, and other ailments, claims that were not adequately supported by well-controlled scientific studies. The case is the first of its kind, representing the first time the FTC has taken enforcement action against marketers of personalized genomic products. The FTC also alleged that the companies maintained insufficient data security measures.

The settlements forbid GeneLink and foru from claiming that their products treat or prevent disease by changing the effects of genes or because of a customers’ unique genetic assessment unless the claims are supported by at least two well-controlled scientific studies. The settlement also prohibits both companies from making misleading claims about their privacy and security practices. Both companies are subject to independent audits for 20 years and must establish adequate data security measures.

For more information about privacy, data security, green claims, and other consumer protection–related issues, contact Sheila A. Millar at millar@khlaw.com or 202 434-4143; JC Walker at walker@khlaw.com or 202 434-4181; or Tracy P. Marshall at marshall@khlaw.com or 202 434-4234.