maximizing & exploiting big data in digital media....legally

Hot Topics in Privacy and Date Security Law1

MediaPost’s Programmatic Insider Summit

MAXIMIZING & EXPLOITING BIG DATA IN DIGITAL MEDIA....LEGALLY

February 22, 2016

Gary A. Kibel

Davis & Gilbert LLPPartnerDigital Media, Technology & [email protected] @GaryKibel_law

© 2016 Davis & Gilbert LLP

WHAT IS PROGRAMMATIC LAW?

»Contracts

+»Self-Regulatory Principles

+»FTC Guidance / Enforcement Actions / Initiatives

+»Old/New Legislation

2 Maximizing & Exploiting Big Data in Digital Media....Legally

LEGAL ISSUES – DATA

3

Traditional ProgrammaticIO DetailsPerformance DataSite DataUser Volunteered DataCollected Data

Bid Data (requests/responses)Losing Bid DataPlatform Data3rd party DMP DataPerformance DataSite Data

Maximizing & Exploiting Big Data in Digital Media....Legally

LEGAL ISSUES – DATA

»Other data issues - Tagging• First party/third party tags• Functionality• Disclosures

- Targeting• Individual profiles vs. segments• Look-a-like modeling• Deterministic and probabilistic modeling


WHAT’S NEXT FOR PASSIVE TRACKING?

»Device fingerprinting»Other persistent identifiers (UDID / IDFA / Android ID)»Location-based services»Cross-device tracking»FTC’s concern about transparency and consumer control»“But we are so beyond cookies at this point, and online

tracking is only becoming more invisible as technology advances in the marketing world.” (Jessica Rich, Director, FTC Bureau of Consumer Protection, January 2015)


LEGAL ISSUES – $$$

»Fraud / Viewability- Intentional vs. unintentional- 1st party vs. 3rd party monitoring- Timing for disputes- Payment terms

»Transparency- Media costs- Service fees- Reporting- Inventory

»Audit rights - financial; data; security6 Maximizing & Exploiting Big Data in Digital Media....Legally

SELF REGULATORY COMPLIANCE

»Digital Advertising Alliance- Self-Regulatory Principles for Online Behavioral

Advertising - Self-Regulatory Principles for Multi-Site Data - Application of Self-Regulatory Principles to the Mobile

Environment (Sept. 1, 2015)»Network Advertising Initiative

- NAI Code of Conduct- Guidance on the Use of Non-Cookie Technologies for

Interest-Based Advertising »More: eDAA, Digital Advertising Alliance of Canada


CONTRACT STRUCTURE

»Platform Agreements»IOs»AAAA/IAB Standard Terms and Conditions»Riders / Addenda»Click-through terms


THE FOCUSON ‘BIG DATA’

DEFINITIONS – WIKIPEDIA

»Big data is a blanket term for any collection of data sets so large and complex that it becomes difficult to process using on-hand database management tools or traditional data processing applications

»An information broker (independent information professional, information consultant) collects and sells information. Uses include targeted ads, market research, consumer scoring, patent searches, and election campaigns. The industry has been criticized for being unregulated and opaque


WHAT IS PERSONAL INFORMATION?

»U.S. definition – ?- COPPA – “personal information”- HIPAA – “protected health information”- GLB – “nonpublic personal information”- State security breach notification laws


WHAT IS PERSONAL INFORMATION?

»E.U. definition – Any information relating to an identified or identifiable natural person (data subject); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity (E.U. Data Protection Directive 95/46/EC)

»Canadian definition – “personal information” means information about an identifiable individual


EXPANDING SCOPE OF PERSONAL INFORMATION

»FTC Consent orders – “Persistent identifiers”»COPPA Amendments 2013 – Definition of personal

information expanded to include any “persistent identifier that can be used to recognize a user over time and across different websites or online services”- Carve out for “support for internal operations”

Certain internal activities would not be considered a collection of PI, as long as the information collected is not used or disclosed to contact a specific individual (e.g., site maintenance and analysis)


» In re: Hulu Privacy Litigation, Case No: 11-03764 (N.D. Cal. 2012) - Video Privacy Protection Act (VPPA)• “Personally identifiable information” includes information which

identifies a person as having requested or obtained specific video materials or services from a video tape service provider

• A video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person

- Data transmitted by clicking the Facebook ‘LIKE’ button could be deemed to be “Personally Identifiable Information,” which means such information identifies a person as having requested or obtained specific video materials from a Video Tape Service Provider.

14

EXPANDING SCOPE OF PERSONAL INFORMATION


DATA MATCHING

»Exploiting CRM databases»PII vs. Non-PII»Matching (i.e., Facebook Custom Audience)

- Privacy Policy conflicts


REPORTS, REPORTS AND

MORE REPORTS …

FTC CHAIRWOMAN EDITH RAMIREZ

»August 2013 – “To me, the FTC is like the lifeguard on a beach. Like a vigilant lifeguard, the FTC’s job is not to spoil anyone’s fun but to make sure that no one gets hurt. With big data, the FTC’s job is to get out of the way of innovation while making sure that consumer privacy is respected”

»June 2015 – “[D]espite the potential for big data’s positive impact on the lives of consumers, there is a real risk of lack of transparency and loss of consumer control … Consumers would likely be surprised to know the myriad of ways in which data is collected about them.”


FTC STATEMENT TO CONGRESS (DECEMBER 2013)

18

»FTC Prepared Statement – “What information do data brokers have on consumers, and how do they use it”- Lack of transparency- No reasonable access to / control of data


»New breach notification law»Consumer Bill of Rights»Amend ECPA»Discriminatory outcomes of big data analytics – ‘digital

redlining’» “The big data revolution presents incredible opportunities

in virtually every sector of the economy and every corner of society”


FTC – DATA BROKERS: A CALL FOR TRANSPARENCY AND ACCOUNTABILITY (MAY 2014)

»Data Brokers = Companies that collect consumers’ personal information and resell or share that information with others

»They operate with a “fundamental lack of transparency”»Consumers are “largely unaware that data brokers are

collecting and using this information”» It is “virtually impossible” for a consumer to determine how

a data broker obtained his or her data»Consumer choices/control are “invisible” and “incomplete”»Call for legislation»Access; opt-outs; disclosures of sources


FTC – BIG DATA: A TOOL FOR INCLUSION OR EXCLUSION? (JANUARY 2016)

»No single law applies. - FTC Act- Fair Credit Reporting Act (FCRA)- Equal opportunity laws

»Commissioner Ohlhausen – “If we give undue credence to hypothetical harms, we risk distracting ourselves from genuine harms and discouraging the development of the very tools that promise new benefits to low income, disadvantaged, and vulnerable individuals.”


FEDERAL TRADE COMMISSION INITIATIVES

ANDENFORCEMENT ACTS

FEDERAL TRADE COMMISSION ACT §5

»“Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful”- Deception = Misrepresentations or omissions likely

to mislead consumers acting reasonably under the circumstances

- Unfairness = Causes or is likely to cause substantial consumer injury, not reasonably avoided by the consumer, and not outweighed by countervailing benefits to consumers or competition


FTC – IN THE MATTER OF SCANSCOUT, INC. (DECEMBER 2011)

»Video ad network»ScanScout privacy policy – “You can opt out of

receiving a cookie by changing your browser settings to prevent the receipt of cookies.”

»However, changing browser settings did not remove or block the Flash cookies used by ScanScout

»Deception claim


FTC – IN THE MATTER OF EPIC MARKETPLACE, INC., AND EPIC MEDIA GROUP, LLC (DECEMBER 2012)

»Ad network»Epic employed “history-sniffing” technology to collect

data about sites outside its network that consumers had visited. Epic’s privacy policy claimed it would only collect information about consumers’ visits to sites in its network

»FTC – “Consumers searching the Internet shouldn’t have to worry about whether someone is going to go sniffing through the sensitive, personal details of their browsing history without their knowledge. This type of unscrupulous behavior undermines consumers’ confidence, and we won’t tolerate it.”


FTC V. GMR TRANSCRIPTION SERVICES (JANUARY 2014)

»50th data security consent order»Independent medical transcription contractors»Independent contractors transmitted medical files

in clear readable text»“The lawsuit also alleges that GMR didn’t monitor

what [its subcontractor] was doing to protect the highly sensitive information in its possession. Taken together, the FTC says that GMR’s course of conduct violated Section 5”

»Vendor liability


FTC – IN THE MATTER OF NOMI TECHNOLOGIES, INC. (APRIL 2015)

»In-store beacon technology»Nomi Privacy Policy – “Nomi pledges to ... Always

allow consumers to opt out of Nomi’s service on its website as well as at any retailer using Nomi’s technology.”

»FTC – “It’s vital that companies keep their privacy promises to consumers when working with emerging technologies, just as it is in any other context. If you tell a consumer that they will have choices about their privacy, you should make sure all of those choices are actually available to them”


PRIVACY POLICIES – FTC MERGER REVIEW (MARCH 25, 2015)

» FTC Merger Review – “The Commission recognizes that to innovate and keep pace in today’s economy, businesses may acquire other companies or sell business units. However, companies must still live up to their privacy promises. One company’s purchase of another doesn’t nullify the privacy promises made when the data was first collected. When a purchase or acquisition does occur, companies have two choices. They can simply abide by their promises – that is, handle the data as promised when they collected it from consumers. Or, if they want to materially change how they collect, use, or share consumers data, they must get permission from the consumers to whom they made the original promise. ” (FTC – March 25, 2015)


LEGISLATION

CalOPPA – CALIFORNIA AB 370(SEPTEMBER 2013)

»Amendment to California Online Privacy Protection Act (CalOPPA)

»Three new privacy policy disclosure requirements (Seven total)

»Disclose how a publisher responds to a “DNT” signal or similar mechanism if that publisher engages in online behavioral advertising

»Cure period»Effective January 1, 2014


CALIFORNIA SB 1348 (FEBRUARY 2014)

»Introduced February 21, 2014»Requires online data brokers to notify consumers

when the broker transfers their personal information to a third party and to provide a description of the content of the information and the identity of the purchaser

»Died in committee


ILLINOIS (IL S.B. 1833)

»A bill to amend the Personal Information Protection Act

»Adding under the definition of “Personal Information” categories for “consumer marketing information,” meaning information related to a consumer’s online browsing, purchase or search history, geolocation information, and more.

»Passed both houses – May 31, 2015 - (vetoed by Governor – August, 2015)


LEGISLATIVE – “DO NOT TRACK ONLINE ACT OF 2015”

33

»Proposed by Senators Markey & Blumenthal »Allow individuals to simply and easily indicate

preference not to have online activities tracked or personal information collected by online providers (limited exceptions)

»Allow FTC to pursue civil penalties if consumer requests not honored


LEGISLATIVE – “APPS Act”

34

»H.R. 4715, the Application Privacy, Protection and Security, or APPS, Act

»Consent based data collection»Rep. Hank Johnson (D-GA): “Privacy is an issue that

should unite us, not drive us apart…We have fully entered the era of big data, and consumers access the Internet through mobile devices now more than ever. It’s past time for our laws to reflect this reality through common-sense rules for data collection, transparency and use.”


35 From Arenas to Zooey: Recent Attempts to Expand Right of Publicity Claims

35 The Basics of Advertising & Marketing Law35

QUESTIONS?Gary A. Kibel

Davis & Gilbert LLPPartnerDigital Media, Technology & [email protected] @GaryKibel_law